Data Sharing with Corporate Group Affiliates

What it is

TikTok may share your personal data with other companies within its corporate group, including affiliated entities and subsidiaries, for a range of stated operational purposes.

Why it matters (compliance & governance perspective)

Sharing data across TikTok's corporate group, which includes entities in multiple jurisdictions, raises cross-border data transfer questions and has been a subject of regulatory scrutiny given the group's ownership structure.

This document changed recently

Consumer impact (what this means for users)

Your personal data may be shared with TikTok's corporate affiliates globally, including entities in jurisdictions with different privacy protections; this is relevant given ongoing regulatory attention to TikTok's data flows and corporate structure.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (cross-border data transfer restrictions and mechanisms including standard contractual clauses and adequacy decisions), UK GDPR transfer provisions, CCPA/CPRA (disclosure requirements for sharing personal information with affiliated entities), and national security considerations raised in several jurisdictions regarding data flows to entities in TikTok's corporate group. The Irish DPC, UK ICO, and the US Committee on Foreign Investment in the United States (CFIUS) have all engaged with aspects of TikTok's corporate data sharing practices, though regulatory outcomes vary by jurisdiction. (2) GOVERNANCE EXPOSURE: High. The breadth of the corporate group sharing authorization, combined with TikTok's complex international corporate structure and the absence in this policy of specific disclosure about which affiliated entities receive data and under what transfer mechanisms, creates significant compliance exposure. EU and UK regulators require that cross-border transfers be supported by an approved transfer mechanism, and the adequacy of existing mechanisms for transfers to TikTok's affiliates in certain jurisdictions has been subject to regulatory inquiry. (3) JURISDICTION FLAGS: EU/EEA (GDPR Chapter V, adequacy and SCCs), UK (UK GDPR international transfer provisions), United States (national security and CFIUS considerations), Australia (Privacy Act cross-border disclosure provisions). The corporate group's connection to ByteDance and potential data access by entities in China has been the subject of specific legislative and regulatory action in multiple markets. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers and government-adjacent organizations using TikTok advertising or analytics services should assess whether their data, or data about their customers, may be shared with corporate affiliates in jurisdictions that present data security or sovereignty concerns. B2B contracts should specifically address corporate group data sharing and specify permissible and impermissible recipient entities. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should request disclosure of which specific affiliated entities receive personal data and the transfer mechanisms supporting those flows. A transfer impact assessment may be required under GDPR for transfers to affiliates in certain jurisdictions. Organizations subject to sector-specific regulations (financial services, defense, government) should assess whether TikTok's corporate group sharing practices are compatible with their regulatory obligations before deploying TikTok-integrated advertising or analytics tools.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Face and Body Feature Data Collection high
• Off-Platform Behavioral Data Ingestion for Ad Targeting high
• Machine Learning and Algorithm Training Using Personal Data medium
• User Content Used in TikTok Advertising Campaigns medium
• Keystroke Pattern and Device Sensor Data Collection high
• Phone and Social Network Contact Syncing medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.